Q: What is ARP?

A: ARP is the Address Resolution Protocol, a tool that TCP/IP systems use to discover the hardware (or MAC) address of the system using a particular IP address. Ethernet and Token Ring network interface adapters have a hardware address assigned to them at the factory. Data link layer protocols use this address to transmit packets to the next system on the trip to their destination. At the network layer, however, IP has its own addressing system. When IP identifies the next system to receive a particular packet, it knows only the system's IP address. Before the data link layer protocol can transmit the packet over the network, it must know the hardware address of that system.

ARP converts the IP address received from the network layer into a hardware address by broadcasting an ARP request message to the local network segment. Every TCP/IP system on the network is responsible for reading incoming ARP requests and responding to those that contain its own IP address. The ARP reply packet returned to the sender contains the system's IP address as well as its hardware address. After receiving the reply, the data link layer protocol on the original system has the hardware address that it needs to transmit the packet. The system also caches the hardware address in memory for a period of time to prevent the need for repeated ARP broadcasts containing the same address.

Some TCP/IP implementations (like the Windows NT client) also use ARP to determine whether or not two systems on the network are using the same IP address. A system broadcasting its own IP address in an ARP request packet should not receive any replies on a properly configured network.

For more information, see page 110 of TCP/IP Administration.